Yes, a saved Terraform plan file can contain secrets. HashiCorp says that if a plan includes sensitive data, it is saved in cleartext in the plan file, even though the terminal hides it. Treat every saved plan as a sensitive artifact: restrict access, set short retention and never attach it to a public ticket.
Why pipelines save plans
The usual pattern is plan on the pull request, approve, then apply exactly what was reviewed. Running terraform plan -out=FILE and then terraform apply FILE guarantees the apply matches the plan. HashiCorp describes saved plans as mainly useful for automation.
That pattern is good practice. The risk is in where the file goes between the two steps.
Where plan files leak
- CI artifact storage, which is often readable by every contributor to the repository.
- Pull request comments, when a job pastes a rendered plan for reviewers.
- Build caches shared across jobs or forks.
- Local directories on a laptop or build agent that outlive the job.
- Logs, when a job prints JSON output for debugging.
HashiCorp also notes the file format is opaque and not intended for other software, so tools that parse it produce their own rendered output. Those renderings can reveal values too.
Controls that help
- Scope artifact access. Make the plan artifact readable only by the job that applies it and the approvers.
- Short retention. Expire plan artifacts within hours or days, not months.
- Encrypt at rest. Use storage that encrypts, with access logging.
- Never comment raw plans on public repos. Post a redacted summary instead.
- Avoid secrets in plans. Prefer ephemeral values or write-only arguments, which are omitted from plan files entirely where providers support them.
- Name files carefully. HashiCorp advises against giving a plan file a suffix Terraform recognizes, such as
.tf.
Plans go stale
A saved plan is a snapshot. If infrastructure changes between plan and apply, Terraform will refuse or the result may differ from what was reviewed. Keep the gap short, and re-plan if approval takes long. Skipping the refresh with -refresh=false can make a plan incomplete or incorrect, so be cautious about using it as a speed trick in pipelines.
A reviewer's view
The review artifact should answer: what changes, and who is affected? It should not need real secret values. If a reviewer needs to see a secret to approve a change, the design is wrong.
Safeguard's compliance and evidence automation can keep records of approvals and gate results, which is useful alongside plan retention rules.
Quick check
If the console shows (sensitive value), is the plan file safe?
Not necessarily. The masking is a display feature. The saved file can still hold the value in cleartext.
Should we stop saving plans?
No. Saving and applying the same plan is a sound practice. Control where the file is stored and how long it lives.
Sources
- terraform plan command reference (HashiCorp Terraform)
- Manage sensitive data in your configuration (HashiCorp Terraform)
Last reviewed: 19 October 2026.
